Elgg / Elgg

mod/uservalidationbyemail/views/default/resources/uservalidationbyemail/confirm.php

<?php

elgg_signed_request_gatekeeper();

$user_guid = get_input('u', false);

// new users are not enabled by default.
$access_status = access_show_hidden_entities(true);

$user = get_user($user_guid);

It seems like $user_guid can also be of type false and string; however, parameter $guid of get_user() does only seem to accept integer, maybe add an additional type check?

if (!$user) {
	return elgg_error_response(elgg_echo('email:confirm:fail'));
}

$user->setValidationStatus(true, 'email');

elgg_push_context('uservalidationbyemail_validate_user');
$user->enable();
elgg_pop_context();

try {
	login($user);
} catch (LoginException $e) {
	return elgg_error_response($e->getMessage());
}

access_show_hidden_entities($access_status);

return elgg_ok_response('', elgg_echo('email:confirm:success'));